NodeZero fits when
You want to run unlimited autonomous pentests yourself across internal networks, cloud, Kubernetes and Active Directory, on an annual per-asset subscription.
ShieldProbe and Horizon3.ai
Horizon3.ai NodeZero and ShieldProbe: compare the scope, then the evidence.
NodeZero runs autonomous pentests that your team launches across networks, cloud, Kubernetes and web applications. ShieldProbe Assess is a pentest of web apps, APIs, networks and servers delivered for you, and a named consultant approves each finding before you see it.
How NodeZero and ShieldProbe compare
Horizon3.ai offers autonomous pentesting across networks, cloud, Kubernetes and web applications. Here is how that lines up with a ShieldProbe engagement.
Scroll the table sideways to compare both options. You can also focus it and use the arrow keys.
| Compared on | Horizon3.ai NodeZero | ShieldProbe |
|---|---|---|
| What it tests | Internal, external, cloud (AWS, Azure and Entra ID) and Kubernetes pentesting, Active Directory password audits and phishing impact tests. NodeZero WebApp tests custom web applications and their REST, SOAP and GraphQL endpoints, including logged-in workflows. | Web apps, APIs (REST, GraphQL, SOAP), networks and servers, internal or external. Black-box for every target; grey-box with your test accounts for web apps and APIs. |
| Findings and review | Proof of each exploit, its impact and mitigation advice. WebApp findings include replayable request and response logs, screenshots and route-level context. Horizon3.ai does not mention a person reviewing findings before you see them. | AI authors each finding and a named consultant approves it before you can see it. Every finding carries the request, response and impact, so your team can reproduce it. |
| Fixes and retests | Remediation guidance and Fix Actions for each weakness. Quick Verify confirms whether a fix worked, and pentests can be scheduled to recur. | Retests of confirmed findings for 12 months under your engagement terms. Fix drafts the code change in VS Code or Visual Studio (beta) for your developers to review. |
| Application protection | NodeZero Tripwires plants decoys and monitoring files during a pentest and alerts on suspicious activity. No in-application protection is described. | Defend, sold separately, adds protection rules for supported findings inside your Node.js app. It starts in log-only mode and blocks only once you turn enforcement on. Ownership flaws such as IDOR are logged, never blocked: they need the code fix. |
| How it runs | Autonomous tests your team launches, with no agents to install. Internal tests run from a Docker host or OVA in your network; external tests run from the Horizon3 cloud. Tests can be scheduled to recur. | A scoped pentest run from our own attack infrastructure. External targets need nothing installed; internal targets are reached through a small connector that needs no admin rights. The report arrives in 48 hours for agreed scope once access is ready. |
| Pricing | Annual subscriptions priced per asset with unlimited pentests, plus a Flex option for occasional testing. WebApp is an add-on or a standalone purchase. | Quoted per assessment from the agreed scope, before testing starts. Defend is sold separately. |
Plan a side-by-side test
Use the same targets and test accounts you gave the other tool. We agree scope and access with you before testing starts.
Which fits your team
ShieldProbe fits when
You want a pentest delivered for you, with every finding approved by a named consultant, business logic tested across your user roles, and findings that carry on into protection and code fixes.
What happens after the report
Each module takes a finding one step further.
Assess
A pentest of your web apps, APIs, networks and servers. A named consultant approves every finding, and each one comes with evidence your team can reproduce.
Explore AssessDefend
Protection for supported findings inside your Node.js app, sold separately. It starts in log-only mode and blocks only when you turn enforcement on. Ownership flaws are logged, never blocked.
Explore DefendFix
A code change drafted from the actual attack, in VS Code or Visual Studio (beta). Your developers review it and raise the pull request.
Explore FixContinuous
Developer preview. Selected tests run on the repository events you enable, so each change is tested as it ships.
Explore ContinuousCommon questions
Is NodeZero limited to network testing?
No. Horizon3.ai documents internal, external, cloud and Kubernetes pentesting, and NodeZero WebApp covers web applications and their APIs.
Can we run ShieldProbe alongside NodeZero?
Yes. Both cover internal and external networks and web applications, so you can test the same scope and compare the results. Keep NodeZero for its cloud, Kubernetes and password-audit operations: ShieldProbe Assess is not a cloud configuration audit.
Is ShieldProbe software we run or an assessment we buy?
Assess is an assessment you buy. You agree the scope, our AI runs the testing, and a named consultant approves every finding before you see it. Defend, Fix and Continuous are tools your team adds afterwards.
Do we install anything?
Not for external targets. Internal targets are reached through our connector or another access path agreed during scoping. Defend, if you add it, runs as an SDK in your Node.js application.
Sources
Details about other products and standards come from the public sources below, reviewed on 20 October 2026 unless dated. If anything has changed, tell us and we will correct it.
- Horizon3.ai NodeZero: operations, proof of exploit, Quick Verify and deployment (reviewed 27 October 2026)
- Horizon3.ai: cloud pentesting (AWS, Azure, Entra ID, Kubernetes) and 1-click verify (reviewed 27 October 2026)
- Horizon3.ai: NodeZero WebApp (reviewed 27 October 2026)
- Horizon3.ai: NodeZero Tripwires (reviewed 27 October 2026)
- Horizon3.ai: packaging and licensing (reviewed 27 October 2026)